Home > Vulnerability Database > CVE-2014-1569

Mend.io Vulnerability Database

CVE-2014-1569

Good to know:

Date: December 15, 2014

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.

Language: C

Severity Score

7.3

Related Resources (18)

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html

Url: http://www.debian.org/security/2015/dsa-3186

Url: https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02

Url: http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Url: https://access.redhat.com/security/cve/CVE-2014-1569

Url: http://www.securitytracker.com/id/1032909

Url: http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Url: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1064670

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-1569

Url: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html

Url: https://www.imperialviolet.org/2014/09/26/pkcs1.html

Url: http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf

Url: http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Url: https://www.mend.io/vulnerability-database/CVE-2014-1569

Severity Score

7.3

Top Fix

Upgrade Version

Upgrade to version NSS_3_17_3_RC0

Learn More

CVSS v3.1

Base Score:	7.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	7.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-1569

Good to know:

Date: December 15, 2014

Language: C

Severity Score

Related Resources (18)

Severity Score

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?